handoff
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests the current conversation history (untrusted data) to generate a summary for a subsequent agent. This creates a surface for indirect prompt injection where malicious instructions embedded in the conversation might be persisted into the handoff document and executed by the next agent.
- Ingestion points: Processes the full conversation history as the primary source of truth for the document.
- Boundary markers: The instructions do not specify using delimiters or XML tags to wrap the summarized content in the output file to prevent the next agent from confusing data with instructions.
- Capability inventory: The skill performs file system writes to the operating system's temporary directory.
- Sanitization: While the skill correctly mandates the redaction of secrets (API keys, passwords) and PII, it lacks instructions to sanitize or escape narrative content that might contain hidden or adversarial instructions directed at the receiving agent.
Audit Metadata